generating-ui-bundle-features
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto invoke the@salesforce/ui-bundle-featurespackage from the npm registry. This package aligns with the author's identified vendor context and the skill's intended purpose for Salesforce UI bundle management. - [COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands using
npxto interact with the features CLI tool. This includes commands for listing, describing, and installing functional components into the local project structure. - [INDIRECT_PROMPT_INJECTION]: The skill processes project source code and user-provided feature names, creating a surface for indirect prompt injection if external data is maliciously crafted.
- Ingestion points: Reads files within
src/anduiBundles/*/src/directories (SKILL.md). - Boundary markers: None explicitly defined in instructions to separate untrusted data.
- Capability inventory: Uses
npxfor package installation and file system modification (SKILL.md). - Sanitization: Relies on the external CLI tool for input handling; no specific sanitization is described in the skill markdown.
Audit Metadata